"user-info"
index=user_interface_type sourcetype=*
| table _time, host, port, _raw | sendemail to="abc@splunk.com" sendresults=true
I use above query to list out the details for the search "user-info"
I want to use this string "user-info" and pass it on in the title of the e-mail as : Notification received for user-info
How to do that ?
If user-info is a string literal then include it as the value of the subject argument to sendemail.
"user-info" index=user_interface_type sourcetype=*
| table _time, host, port, _raw
| sendemail to="abc@splunk.com" sendresults=true subject="user-info"
But i Want to add the subject as "Notification received for <then the string that I searched in the query">
| sendemail to="abc@splunk.com" sendresults=true subject="Notification received for user-info"
There is no back-reference to string literals.